FINAL ORDER MO-4288-F

Appeal MA18-199

Peterborough Public Health

November 28, 2022

Summary: This Final Order follows Interim Order MO-3970-I, issued October 28, 2020, and Interim Order MO-4200-I, issued May 18, 2022. In Interim Orders MO-3970-I and MO-4200-I, Peterborough Public Health was ordered to conduct further searches for records responsive to the appellant’s request for access to records on which PPH based its assessments that the Peterborough and District Farmers’ Market was exempt from the Food Premises Regulation of the Health Protection and Promotion Act between 2013 and 2018.

Interim Order MO-4200-I also required PPH to provide specified affidavits and documents to the IPC regarding PPH’s failure to preserve its copy of the records at issue and its deletion of email accounts that would have likely contained responsive records.

In this Final Order, the adjudicator finds that further searches would not yield more records and, on that basis, upholds PPH’s search for responsive records. She also determines that PPH has addressed concerns about its failure to preserve records by putting in place reasonable measures to preserve records in its custody or control. The adjudicator dismisses the appeal.

Statutes Considered: Municipal Freedom of Information and Protection Privacy Act, R.S.O. 1990, c. M.56, sections 4.1  and 17 .

Orders and Investigation Reports Considered: Interim Orders MO-3970-I and MO-4200-I.

OVERVIEW:

[1] This Final Order, which follows Interim Orders MO-3970-I and MO-4200-I, addresses concerns about the reasonableness of Peterborough Public Health’s (PPH) search for records responsive to the appellant’s access request and its failure to preserve responsive records. The appeal arises from the appellant’s request for access to the following records related to the Peterborough and District Farmers’ Market (the Farmers’ Market) under the Municipal Freedom of Information and Protection of Privacy Act (the Act):

• all reports from the Peterborough and District Farmers’ Market Association (PDFMA) identifying all stall operators and the stall operators identified as ‘producers who are primarily selling or offering for sale their own products’
• any other relevant materials upon which PPH bases its assessment as to whether or not the Farmers’ Market is considered exempt from the Food Premises Regulation [1] covering the calendar years of 2013 to [January 19, 2018].

[2] PPH decided to withhold the stall operator lists, claiming that they contain personal information belonging to the stall operators and were exempt under the mandatory personal privacy exemption in section 14(1) of the Act. The appellant appealed PPH’s decision to withhold the stall lists and the reasonableness of its search for records.

Interim Order MO-3970-I

[3] In Interim Order MO-3970-I, the first interim order, I found that the lists are not exempt from disclosure under section 14(1) of the Act and ordered PPH to disclose them to the appellant. I also addressed the appellant’s challenge of the reasonableness of PPH’s search for records responsive to his request and agreed with the appellant that PPH had not conducted a reasonable search for responsive records. In order provisions 2 and 3 of Interim Order MO-3970-I, I ordered PPH to conduct further searches and provide evidence of its searches, as follows:

2. I order PPH to conduct further searches for all records upon which it bases its assessments as to whether the Farmers’ Market is exempt under the Food Premises Regulation. PPH shall search for all inspections and assessment field notes and reports, stall operator questionnaires, PPH office notes, summaries, meeting notes, and correspondence between PPH staff and other institutions and/or third parties, in paper and electronic form.

3. I order PPH to provide me with an affidavit or affidavits sworn by individuals who have direct knowledge of the searches, which are to include at a minimum the following information:

(a) The names and positions of the individuals who conducted the searches.

(b) The steps taken in conducting the searches.

(c) The types of files searched and the results of each search.

PPH’s response to Interim Order MO-3970-I

[4] In response to provisions 2 and 3 of Interim Order MO-3970-I, PPH conducted a further search and located additional records responsive to the request. PPH then provided an affidavit from its Director of Public Health Programs, Chief Nursing Officer and Privacy Officer that included approximately 100 pages of exhibits. Exhibit “A” to the affidavit contained an email exchange between the Director and PPH’s IT Helpdesk that stated:

• the search for records yielded no results in respect of four email accounts, which had been deleted;
• the deleted email accounts were those of:
• the Manager who was PPH’s Freedom of Information Coordinator when the appeal started, and who was also responsible for PPH’s Food Premises Regulation exemption decisions, and
• three PPH Public Health Inspectors.

[5] PPH also advised me that it did not have a copy of the original 61-page package of records at issue in this appeal (containing the lists of stall operators), despite its having provided the 61 pages of records to the IPC at the outset of the appeal. Because PPH no longer had a copy of the records at issue, the IPC provided PPH with a copy of the 61- page package of its records. PPH then provided the affidavit, including the additional responsive records and the original 61 pages of records to the appellant.

[6] I invited the appellant to provide representations in response to PPH’s affidavit and he did. In his response, the appellant raised serious concerns about PPH’s record retention practices; specifically, its failure to preserve responsive records, its inability to search for responsive records in the email accounts of former PPH employees on the basis that their email accounts had been “deleted,” and the fact that PPH’s backup email records are “overwritten” every two weeks.

[7] I shared the appellant’s serious concerns about the integrity of PPH’s recordkeeping policies and practices, particularly, its deletion of records that are, or may be subject to an outstanding access request and appeal. I subsequently wrote to PPH twice seeking additional information about PPH’s records retention policies and practices. I referred PPH to section 4.1 of the Act, which addresses measures to ensure the preservation of records, as follows:

Every head of an institution shall ensure that reasonable measures respecting the records in the custody or under the control of the institution are developed, documented and put into place to preserve the records in accordance with any recordkeeping or records retention requirements, rules or policies, whether established under an Act or otherwise, that apply to the institution.

[8] I asked PPH to consider its duty to preserve records under section 4.1 of MFIPPA and any other applicable recordkeeping or retention requirements, rules or policies that apply to PPH, in answering questions about its record preservation measures. I asked PPH to provide copies of its documented records preservation measures at the time of the request and throughout the request and appeal, and to explain how these changed.

[9] I also asked whether PPH ensured it had reasonable measures in place to preserve its records, in accordance with its duty to do so under section 4.1 of MFIPPA, and, if so, how it inadvertently deleted the Manager’s email account. I asked PPH to provide direct affidavit evidence from the individual who deleted the Manager’s emails while a freedom of information request and appeal were pending, including details of when, why and how the emails were deleted, and at whose direction. Finally, I asked PPH to provide complete details regarding its submission that it had conducted an internal review of the inadvertent deletion and had taken steps to address the situation so that emails are not inadvertently deleted when an employee leaves PPH in the future.

[10] In response to my letters, PPH provided ten documents regarding its organizational procedures for record filing, storage, retention, retrieval and destruction, and the “Guidelines on Minimum Retentions for Health Unit Records” dated December 2012 and published by the Association of Local Public Health Agencies. PPH also explained that it had policies and procedures in place at the time of the request and that it updated its policies and procedures for record retention in 2019; however, it has now identified the need for a procedure for digital files and it will develop additional procedures for the storage and destruction of electronic records.

[11] Regarding its deletion of the Manager’s account, PPH stated that it identified a gap in its retention of emails for certain accounts between September 2017 and October 2019. Prior to September 2017, PPH retained and backed up all of its electronic records on onsite servers and stored a backup at a second location. In September 2017, PPH moved to the Microsoft Office 365 platform, and “with this new system in place, when an email account was terminated, the attached email files were deleted.” Between September 2017 and October 2019, eight email accounts were terminated, resulting in the inadvertent loss of all the associated email files in those eight accounts. PPH explained that its IT department and its managers misunderstood the email account deletion process – while the IT department believed that managers would filter out relevant emails prior to the email account being deleted, the managers believed that only the email profile would be deleted with associated emails being preserved. In the case of the Manager’s email account, PPH stated that on September 5, 2019, IT staff asked the Executive Assistant to confirm that both the Director of Programs and the Director of Operations approved the list of eight former staff whose email accounts would be deleted, including the Manager’s email account.

[12] PPH did not provide direct affidavit evidence from the individual who deleted the Manager’s email account and associated emails. However, it did provide details about how the email accounts were deleted. PPH stated that in October 2019, it upgraded its system to Veeam for Office 365, which does not permit deletion of emails and automatically retains emails for 10 years. It added that the backup of all files across PPH is done nightly, and the backups retain all data, except for the deleted emails for eight former staff members whose email accounts were deleted on September 5, 2019.

[13] PPH identified three factors that contributed to the deletion of the emails:

1. Electronic documents, such as emails, were not explicitly identified in the records retention policy. Despite this, these documents had been retained up to September 2017, even after an employee left the organization.
2. The lack of communication to and understanding by management staff of the automatic deletion of emails when closing an account, which became a moot issue in October 2019 when it upgraded to Veeam for Microsoft Office 365.
3. The change in program platform to Microsoft Office 365 and document storage was brought forward to the Privacy Committee, but the focus of the discussion was the security of the storage and potential for site storage to be in the USA. The issue of email deletion with a closed account was not highlighted.

[14] PPH stated that its IT department has clarified that “emails are now stored on active servers and backed up every other night.” It adds, “What is overwritten is the previous backup, not the emails themselves. Any issues related to how storage occurred under the Office 365 platform were remedied by the upgrade to Veeam for Office 365 in September 2019.” PPH stated that by having this new software program in place, PPH exceeds the required “current plus seven years” requirement by keeping the emails for 10 years, at which point they are deleted automatically, unless they are transferred to another server or storage site.

Interim Order MO-4200-I

[15] I then issued Interim Order MO-4200-I, in which I found that PPH had not complied with Interim Order MO-3970-I. In Interim Order MO-4200-I, I ordered PPH to conduct an additional further search for records responsive to the appellant’s request for materials related to PPH’s assessment of whether the Farmers’ Market qualified for exemption from the Food Premises Regulation from 2013 to 2018, and to provide affidavits detailing these further searches. I also ordered PPH to provide affidavits from individuals with direct knowledge of the searches it had conducted, and to produce copies of specific records mentioned in PPH’s initial affidavit.

[16] Regarding PPH’s recordkeeping failures in this appeal, I wrote the following in paragraphs 38 to 40 of Interim Order MO-4200-I:

[38] In particular, I share the appellant’s concern about PPH’s deletion of the Manager’s email account during the course of this appeal, and its loss of all responsive records that were likely contained in that email account. Along with the Manager’s email account, the email accounts of three Public Health Inspectors were also deleted in their entirety on September 5, 2019 — a fact confirmed in an email exchange between PPH’s affiant and an IT representative in Exhibit “A” to the affidavit. Like the deleted Manager’s account, the deleted email accounts of the three Public Health Inspectors likely contained records responsive to the appellant’s request for “any other relevant materials upon which PPH bases its assessment as to whether or not the Farmers’ Market is considered exempt from the Food Premises regulation.” Although PPH maintains that the deletion of the Manager’s and three Public Health Inspectors’ email accounts was inadvertent — the result of an erroneous belief on the part of PPH’s management that deletion of an email account resulted in the deletion of the email profile but not the complete email history of the account — I will require more sworn evidence, as discussed below, before accepting that to be the case.

[39] In this regard, I note that the Manager who was PPH’s Freedom of Information Coordinator when the appeal started, and who was also responsible for PPH’s Food Premises Regulation exemption decisions, located only 61 pages of responsive records in 2018. The Manager then left his employment with PPH sometime before the issuance of Interim Order MO-3970-I in 2020. During that same time, PPH deleted the complete email accounts of eight staff members, including the account of the departed Manager and the accounts of three Public Health Inspectors, all four of which very likely contained records responsive to the appellant’s request. Finally, despite order provisions 3 and 4 of Interim Order MO-3970-I, PPH failed to provide any affidavits from the Manager, from any of its Public Health Inspectors, or from the Medical Officer of Health about its searches or about the email account deletions. Instead, PPH submitted an inadequate affidavit from an affiant who does not have direct knowledge of PPH’s searches for responsive records or of any of the troubling instances of records destruction set out above.

[40] Among the significant errors and failures on the part of PPH is its loss of its copy of the 61 pages of records at issue in this appeal. PPH’s failure to preserve its copy of the records at issue and the deleted email accounts is inconsistent with its duty under section 4.1 of the Act to ensure it has reasonable measures to preserve records in its custody or control. PPH’s explanation that it now has a software and email backup system that retains all emails for 10 years is not reassuring considering what appears to be PPH’s disregard of its duty to preserve records. I will require more evidence from PPH in order to fully understand what led to its loss of records and to assess whether it has taken appropriate steps in response.

[17] In order provisions 1-3 of Interim Order MO-4200-I, I wrote:

1. I do not uphold PPH’s further search for records responsive to the request. I order PPH to:

a. conduct additional further searches for all records upon which it based its assessments that the Farmers’ Market was exempt under the Food Premises Regulation between 2013 and 2018. PPH shall search for all inspections and assessment field notes and reports, stall operator questionnaires, PPH office notes, summaries, meeting notes, and email and other correspondence, whether in paper or electronic form:

1. Between all PPH staff, and specifically including the Medical Officer of Health,

2. Between any and all PPH staff, on one hand, and representatives of the Farmers’ Market (its manager, any stall operators, and any members of its board), on the other, and specifically including the secretary at the email address noted by the appellant, and

3. Between all PPH staff and any other third parties.

b. provide me with affidavits sworn only by individuals who have direct knowledge of these additional further searches, which are to include at a minimum the following information:

1. The name and position of the individual who conducted the searches,

2. The steps taken in conducting the searches, and

3. The types of files searched and the results of each search.

2. I order PPH to provide me with the affidavits and the results of its additional further searches, ordered under provisions 1(a) and (b) above, by [a specified date].

3. I order PPH to provide me with a copy of the following documents, referenced in the affidavit sworn by the Director, by [a specified date]:

a. The “file notes” of the Manager (paragraph 3 of the affidavit).

b. The complete emails between the Director and PPH IT Helpdesk regarding the “ticket” she submitted on November 2, 2020 (paragraph 10).

c. The complete emails mentioned in the email of November 4, 2020 at 10:32 AM (that appears in Exhibit ‘A’) that were “moved into a folder in [the Director’s] idrive called “Ticket 7697”.” (paragraphs 11, 12 and 13)

d. A list of PPH’s annual inspection dates of the Farmers’ Market for the years 2013 to 2018 (paragraph 17).

PPH’s response to Interim Order MO-4200-I

[18] In response to Interim Order MO-4200-I, PPH provided a 156-page submission, composed of 15 pages of representations, six affidavits from various employees who conducted searches for records, and exhibits to the six affidavits, including the documents that I ordered produced in Order provision 3.

[19] PPH submits that, in accordance with Order provision 1 of Interim Order MO-4200- I, it conducted additional further searches for all records upon which it based its assessments that the Farmers’ Market was exempt under the Food Premises Regulation between 2013 and 2018, and has searched for any inspections and assessment field notes and reports, stall operator questionnaires, PPH office notes, summaries, meeting notes, and email and other correspondence, whether in paper or electronic form, between all PPH staff, and specifically including the Medical Officer of Health, between any and all PPH staff, on one hand, and representatives of the Farmers’ Market (its manager, any stall operators, and any members of its board), on the other, and specifically including the secretary at the email address noted by the appellant, and between all PPH staff and any other third parties.

[20] PPH submits that the six affidavits it provides in support of its satisfaction of Order provisions 1 and 2 were sworn only by individuals who have direct knowledge of these additional further searches, which include at a minimum the name and position of the individual who conducted the searches, the steps take in conducting the searches and the types of files searched and the results of each search. The individuals who have sworn the six affidavits are PPH’s Director of Operations, its Manager for Environmental Health, a Computer Technician/Analyst, and three of its public health inspectors. The affidavits provide details of the searches conducted, including the individuals who conducted the searches, the search terms used, the accounts, files and locations searched, the times of the searches and the results of each search. The affidavit of the Computer Technician/Analyst is particularly detailed. I will not set out further details of the searches conducted that are contained in the sworn affidavits because it is unnecessary to do so here. As noted below, the appellant has received a complete copy of PPH’s representations, including its complete affidavit evidence.

[21] In its representations, PPH explains that, pursuant to section 2(2)(c) of the Food Premises Regulation, it does not have an obligation to verify a Farmers’ Market assertion that the Farmers’ Market qualifies for exemption under the Food Premises Regulation exemption, as alleged by the appellant, and, thus, it has no records responsive to the appellant’s request for “all records upon which it based its assessments that the Farmers’ Market was exempt under the Food Premises Regulation between 2013 and 2018.” Section 2(2)(c) of the Food Premises Regulation reads:

This Regulation applies to all food premises, except, farmers’ market food vendors.

[22] PPH submits that, as a result of section 2(2)(c) of the Food Premises Regulation, food vendors at farmers’ markets that have qualified for the exemption are not subject to an inspection requirement. And furthermore, at the time of the appellant’s access request, PPH had no statutory obligation to inspect a farmers’ market to determine whether vendors were truthfully advising PPH that they were selling their own products.

[23] In response to order provision 3 of Interim Order MO-4200-I, PPH includes various emails as Appendix B to its representations and it notes that it has already disclosed any responsive records contained in the “street file” (referred to as “file notes” in order provision 3) to the appellant.

[24] After receiving a copy of PPH’s submission in response to Interim Order MO-4200- I, the appellant provided representations. In his representations, the appellant submitted that PPH did not comply with order provision 1.a of Interim Order MO-4200-I because it did not include all of the email addresses used by its staff; the appellant noted that PPH has used two different email domain names for its staff email addresses, and that PPH’s Medical Officer of Health also used two different surnames during the time period of interest in this appeal. The appellant also argued that it was not possible to discern whether PPH complied with order provisions 3.a, b, and c because PPH has not provided an index of records that identifies the records it has located and disclosed. [2]

[25] PPH’s final response, submitted October 31, 2022, PPH confirms that its response reflects the active email address of each staff member, which includes any other email addresses (either using a prior domain name or prior surname) and any associated relevant emails, because these are part of the same email account for that staff member. PPH also confirms that there were no Farmers’ Market assessment inspections in January 2018, contrary to the appellant’s assertions.

DISCUSSION:

[26] The narrow issue to be resolved is whether PPH has now conducted a reasonable search for records responsive to the appellant’s request. For the reasons set out below, I am satisfied that it now has. However, as I explain below, it is highly troubling and unfortunate, to say the least, that PPH deleted entire email accounts that could well have contained responsive records, and that it did so when an access request appeal relating to those records was ongoing.

[27] Having reviewed PPH’s complete representations, including the six affidavits provided in response to Interim Order MO-4200-I, I accept PPH’s evidence that it has satisfied provisions 1, 2 and 3 of Interim Order MO-4200-I, and has conducted a reasonable search for records responsive to the appellant’s request. The six affidavits contain extensive details about the searches conducted by PPH and include numerous records and documents confirming the results of the searches. As well, PPH’s representations, including its responses to my follow-up correspondence and its replies to the appellant’s responses, address the appellant’s concerns about PPH email account domain names and other aspects of its search. PPH has disclosed numerous responsive records following each of the two interim orders issued in this appeal to the appellant, and has responded to his extensive and detailed representations with a significant amount of information. I accept PPH’s submission that it has now conducted a reasonable search for responsive records and that there is no reasonable basis to believe that further responsive records exist. As a result, I uphold the reasonableness of PPH’s search for responsive records.

[28] As for the recordkeeping concerns I noted in Interim Order MO-4200-I and discussed above, PPH’s loss of the 61-page package of records at issue and its deletion of the email accounts of its Manager and three inspectors, which accounts would have likely contained responsive records, were serious failures of PPH’s recordkeeping obligations under the Act. As documented above, I have now received sufficient information from PPH about its improved recordkeeping policies and procedures. PPH explained how it has remedied its recordkeeping practices in accordance with its obligations under the Act. I accept that PPH has improved its record retention practices and ensured that they comply with its obligations under the Act. I am satisfied that PPH has addressed my concerns about its failure to preserve records by putting in place reasonable measures to preserve records in its custody or control, and I expect that PPH will not repeat the noted failures in the future.

ORDER:

I uphold the reasonableness of PPH’s search for responsive records and I dismiss the appeal.

Original Signed by:		November 28, 2022
Stella Ball
Adjudicator